--- 1/draft-ietf-lamps-rfc6844bis-02.txt 2018-11-06 11:13:11.193982664 -0800 +++ 2/draft-ietf-lamps-rfc6844bis-03.txt 2018-11-06 11:13:11.233983632 -0800 @@ -1,20 +1,21 @@ Network Working Group P. Hallam-Baker -Internet-Draft R. Stradling -Obsoletes: 6844 (if approved) Comodo Group, Inc -Intended status: Standards Track J. Hoffman-Andrews -Expires: May 8, 2019 Let's Encrypt - November 04, 2018 +Internet-Draft Comodo Group, Inc +Obsoletes: 6844 (if approved) R. Stradling +Intended status: Standards Track Sectigo +Expires: May 10, 2019 J. Hoffman-Andrews + Let's Encrypt + November 06, 2018 DNS Certification Authority Authorization (CAA) Resource Record - draft-ietf-lamps-rfc6844bis-02 + draft-ietf-lamps-rfc6844bis-03 Abstract The Certification Authority Authorization (CAA) DNS Resource Record allows a DNS domain name holder to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain. CAA Resource Records allow a public Certification Authority to implement additional controls to reduce the risk of unintended certificate mis-issue. This document defines the syntax of the CAA record and rules for processing CAA records by certificate issuers. @@ -29,21 +30,21 @@ Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on May 8, 2019. + This Internet-Draft will expire on May 10, 2019. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -309,23 +311,23 @@ set exists, a CA MUST NOT issue a certificate unless the CA determines that either (1) the certificate request is consistent with the applicable CAA Resource Record set or (2) an exception specified in the relevant Certificate Policy or Certification Practices Statement applies. A certificate request MAY specify more than one domain name and MAY specify wildcard domains. Issuers MUST verify authorization for all the domains and wildcard domains specified in the request. - The search for a CAA record climbs the DNS name tree from the - specified label up to but not including the DNS root '.' until CAA - records are found. + The search for a CAA Resource Record set climbs the DNS name tree + from the specified label up to but not including the DNS root '.' + until a CAA Resource Record set is found. Given a request for a specific domain name X, or a request for a wildcard domain name *.X, the relevant record set RelevantCAASet(X) is determined as follows: Let CAA(X) be the record set returned by performing a CAA record query for the domain name X, according to the lookup algorithm specified in RFC 1034 section 4.3.2 (in particular chasing aliases). Let Parent(X) be the domain name produced by removing the leftmost label of X. @@ -722,21 +724,21 @@ when used on domains that utilize many CNAMEs, and would have made it difficult for hosting providers to set CAA policies on their own domains without setting potentially unwanted CAA policies on their customers' domains. This document specifies a simplified processing algorithm that only performs tree climbing on the domain being processed, and leaves processing of CNAMEs and DNAMEs up to the CA's recursive resolver. This document also includes a "Deployment Considerations" section detailing experience gained with practical deployment of CAA - enforcement amount CAs in the WebPKI. + enforcement among CAs in the WebPKI. This document clarifies the ABNF grammar for issue and issuewild tags and resolves some inconsistencies with the document text. In particular, it specifies that parameters are separated with hyphens. It also allows hyphens in property names. This document also clarifies processing of a CAA RRset that is not empty, but contains no issue or issuewild tags. 9. IANA Considerations @@ -852,18 +854,18 @@ . Authors' Addresses Phillip Hallam-Baker Comodo Group, Inc Email: philliph@comodo.com Rob Stradling - Comodo Group, Inc + Sectigo Ltd. - Email: rob.stradling@comodo.com + Email: rob@sectigo.com Jacob Hoffman-Andrews Let's Encrypt Email: jsha@letsencrypt.org